Canonical strategy: JIT_AT_GATE_OPEN

This val preserves the R2 GitHub bootstrap outside the high-churn private repository so activation does not depend on keeping a stale long-lived PR alive.

• sealed control package SHA-256: afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f
• payload copy audit: 5/5 exact
• long-lived activation PR: forbidden by strategy
• merge authorization: disabled by default
• production_go: false

Read MANIFEST.json and MATERIALIZATION_CONTRACT.md before materializing anything.